Security researchers have put together a monster number-crunching rig capable of cracking strong passwords by brute force in minutes.
Jeremi Gosney (aka epixoip) demonstrated a machine running the HashCat password cracking program across a cluster of five servers equipped with 25 AMD Radeon GPUs at the Passwords^12 conference in Oslo, Norway.
Gosney’s system means that even strong passwords protected by weak one-way encryption algorithms, notably the one used in Microsoft's LM and NTLM, are vulnerable.
A 14-character Windows XP password hashed using Lan Manager can be cracked from its hash value in just six minutes. LM splits a 14-character password into two seven-character strings before hashing them, which means it's a good deal less secure than an eight character password hashed with other encryption schemes. Brute forcing an eight-character password would take 5.5 hours, Security Ledger reports.
The attack could be run against leaked password hashes but not login methods directly. Since data breaches are by no means rare, this is not much of a barrier against misuse.
Services such as WPACracker and CloudCracker, a cloud-based platform for penetration testers, have already shown that older encryption algorithms and shorter passwords are hopelessly insecure. Gosney's research further underlines the point. ®